A bunch of retailers, including Amazon, Target, and Walmart, pulled their listings for a line of smartphone-connected stuffed animals called CloudPets this week after they were found to be storing kids’ voice recordings online without any security measures, among other issues. The news offers them good optics, but the reality is that this security revelation came about in February of last year: it took the massive retailers over a year to remove the stuffed animals, during which time they likely sold at least some of their inventory.

The toy’s removal only happened after the Electronic Frontier Foundation wrote a letter this week to Walmart, Target, and Amazon requesting that the CloudPet listings be taken down. The organization writes…